I have a remote server into which I login via ssh. On this server I have setup a Wireguard VPN to which my host connects. The ssh server (ssh daemon) listens on a private IP interface (the server's Wireguard interface). It seems to me that the only way to get into my remote server (even try to) would be to have my Wireguard connection file (including the shared password and the private password) + have my private SSH key + (I think that's the easy part if the attacker were to get this far) know the private interface's IP.
Oh, and another detail, I only let the private VPN IP addresses through the firewall to the SSH port.
So I was wondering - is this method foolproof or might I be missing something? Seems to me like even if I were to allow empty passwords, without my Wireguard connection to the server the attacker still couldn't get into my remote server.
P.S. Foolproof, as in, if my host's Wireguard conf and SSH private key doesn't get compromised (at which point only a password on the SSH key would stall the attacker, I think)